right, all the traffic runs through the capwap tunnel to your WLC where it gets the first contact with the "network" The tunnel "data" part can also be encrypted if u want. That's the great benefit if u want that :).

As mentioned already but want to expand on this .. 

The purpose of the local vlans is to drop the traffic off al the local network rather than bring it back to the wlc. 

Main the case of your guest you are brining this back which means you simply anchor guest back to the central wlc. The guest ride the data plane back to the wlc and get dropped on your central wlc interface. Keeping in mind if you lose connection back to the c rural wlc you will also lose guest access.